Permission settings - per user/global/both
| Project: | Content Management Filter |
| Version: | 6.x-1.x-dev |
| Component: | Code |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed |
Jump to:
Referring to #328869: CMF and access management, I quote
On the other hand, if any role is granted the "filter and manage site content", any user of that role can :
- display the Content Tab on his My account page
- list, access and edit his own nodes
- list all nodes he is NOT granted to access or edit - (though he can't access or edit them)
And going through lines 31-63 of cmf.module, I noticed the array of access arguments required both permissions to have a cmf tab on every user account page.
In my case, I only gave the global permission (filter and manage site content) to an administer role and not the per user permission (view user content list). Nonetheless the administrator gets to see the cmf tab on every user page.
I noticed a custom permissions call back function, but my skills aren't really that good.
Is this intended? I would figure their is a difference in having access to the list on every user page or just to a global listing.
thx,
Koco
#1
One of the main reasons why I started looking at this module is because I have a need to control site comment spammers, so yes, it was my intention that admins can see the user tab for every user. That does not mean, however, that it is correctly set up. I questioned that menu entry when I saw it, but haven't had much time to investigate it.
I probably need to change the custom permissions to 'view user content list' or 'access user profiles'.
#2
Okay, the user tab now requires either 'view user content list' or 'access user profiles'.
Needs to be back-ported to 5.x.
#3
Committed to 5.x-1.x-dev.
#4